Re: [Isms] review of draft-ietf-isms-radius-usage

[Wes Hardaker <wjhns1 at hardakers.net>]

Hi Kaushik,

Thanks for the responses!

KN> You are right. Service authorization is a coarse granular mechanism
KN> to limit SNMP access only to operators/admins and deny access to a
KN> large population of users that may be authenticated by the RADIUS
KN> server. As you point out, lack of service authorization will require
KN> administrators to setup VACM and it is not a security issue but it
KN> provides ease of management.

KN> We will update the text in this section

Thanks.  Please make sure that it's clear that the important thing is
that RADIUS may propose additional restrictions, but just by using
RADIUS you still need VACM configuration in place until the "future
research" on distributing VACM content is completed.  RADIUS may result
in closing of the connection and no messages making it to the VACM
layer, but it doesn't remove the VACM layer either...

> No where in this section does it discuss the ramifications of relying on
> a centralized network based authentication system.  Looking very quickly
> (but not in detail so I may have missed it) at the other documents that
> this section references, it doesn't look like they do either.  SNMP has
> traditionally designed to be used in a way that makes it always
> available if you can get to the device in question.  The use of RADIUS
> changes this and adds additional dependencies on network availability.
> It will now possible to perform new denial of service attacks by
> attacking the infrastructure between the SNMP server using RADIUS for
> authentication and the RADIUS server providing that authentication
> back-end.  The use is certainly well justified as RADIUS will provide
> many positive benefits that may be worth the cost, but the downsides
> should still be documented.

KN> Section 4.1 of RFC3579 discusses the threat model for RADIUS. All those
KN> threats apply to usage of RADIUS in ISMS.

That section doesn't discuss my concerns above.

-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms